The following PHP code triggers a segmentation fault due to a NULL pointer dereference:

<?php
mb_regex_encoding('iso-8859-11');
$test_str = 'x';

if (mb_ereg_search_init($test_str)) {
    $val = mb_ereg_search_pos("x");
    var_dump($val);
} else {
    var_dump(false);
}

The crash occurs due to a mismatch between Oniguruma and mbfl encoding support:

1. Oniguruma (the regex library) supports iso-8859-11 (Thai encoding)
2. mbfl (mbstring's internal encoding library) does NOT support iso-8859-11

When mb_regex_encoding('iso-8859-11') is called:

• php_mb_regex_set_mbctype() validates the encoding against Oniguruma → succeeds
• mbfl_name2encoding('iso-8859-11') is called → returns NULL
• MBREX(current_mbctype_mbfl_encoding) is set to NULL

Later, when mb_ereg_search_init() calls php_mb_check_encoding():

• php_mb_regex_get_mbctype_encoding() returns NULL
• php_mb_check_encoding() dereferences the NULL pointer → SEGV

This vulnerability allows a denial of service (DoS). An attacker can reliably crash a PHP process when user-controlled input influences the encoding passed to mb_regex_encoding() and the application subsequently uses mbregex search APIs.

Enumeration of all Oniguruma-supported encodings vs mbfl support:

Credits

Viet Hoang Luu - The University of Melbourne
Amirmohammad Pasdar - The University of Melbourne
Wachiraphan Charoenwet - The University of Melbourne
Shaanan Cohney - The University of Melbourne
Toby Murray - The University of Melbourne
Van-Thuan Pham - The University of Melbourne